I have two interfaces, vlan.202 and tap0. vlan.202 is my VLAN for VPN clients and originally I just used to tunnel all my VPN clients onto a random subnet and have them share my host IP, but I would like to actually have my clients tunnel in and be dumped unto the VPN clients VLAN. This server I am working on is NOT the primary router and is just a server with a link to the VLAN. I want to do this so all clients are forced to talk to my router and cant router to other VLANs by using my servers routing table.
In a nutshell, I want to bridge the interfaces without any IPs on the server on that VLAN. I just want my clients to be dumped onto the VLAN as if a hub was there. (Just taking all packets received on one interface and putting them on the other.)
What I have tried:
I am still very new to IP Tables, but I have literally spent 8+ hours at this point.
- I tried creating a forwarding rule that would just take an input interface and jump it to an output, but the rule was never hit since there was no IP and that packets were targetting me as their gateway.
- I tried playing with input and output chains as well but had no luck.
- I tried creating new chains as seen below to allow me to input and output but they failed to accomplish the goal as well.
My OpenVPN Server Config:
; Connection Details local 10.10.3.2 port 25000 ;proto tcp proto udp dev tap0 ;dev tun ; Keys & Certs ca ca.crt cert SP.crt key SP.key dh dh4096.pem tls-auth ta.key 0 ; Subnet for Clients server-bridge 10.20.8.1 255.255.255.0 10.20.8.2 10.20.8.254 push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 126.96.36.199" push "dhcp-option DNS 188.8.131.52" keepalive 10 120 ; Encryption Settings cipher AES-256-CBC auth SHA256 ; Compression Settings ;compress lz4-v2 ;push "compress lz4-v2" max-clients 10 ; Security Settings to Avoid Attacks user nobody group nogroup persist-key persist-tun ; Logging status /var/log/openvpn/openvpn-status.log ;log /var/log/openvpn/openvpn.log log-append /var/log/openvpn/openvpn.log verb 3 ;mute 20
My IP Table Config:
# START OPENVPN RULES # Mangle table rules *mangle :PREROUTING ACCEPT [0:0] # Custom Chains -N V202 -A V202 -i tap0 -o vlan.202 -g POSTROUTING -N TAP -A TAP -i vlan.202 -o tap0 -g POSTROUTING # TAP <-> vlan.202 -A PREROUTING -i vlan.202 -g TAP -A PREROUTING -i tap0 -g V202 COMMIT # END OPENVPN RULES